HealthPlan Services
Disclosed Apr 28, 20233 years ago9,684 affectedConfirmed
The business associate (BA), HealthPlan Services, reported that it was the subject of a ransomware attack that affected the protected health information (PHI) of 9,650 individuals. The PHI involved included names, addresses, Social Security numbers, dates of birth, drivers’ license numbers, health insurance information, financial information, and other treatment information. The BA notified HHS, affected individuals, and the media. In response to the breach, the BA provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards.
What is known
| People affected | 9,684 (as reported by the organization) |
|---|---|
| Disclosed | Apr 28, 2023 |
| Happened | Jun 22, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: HealthPlan Servicesoag.ca.gov · Official notice | Official notice |
| Indiana Attorney General 2023 data breach report: HealthPlan Servicesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): HealthPlan Services (Business Associate, FL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Apr 28, 2023 | |
| HHS archivetotal | Apr 28, 2023 | 9,650 |
| Indiana AGresidents of IN | May 19, 2023 | 1 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), HealthPlan Services, reported that it was the subject of a ransomware attack that affected the protected health information (PHI) of 9,650 individuals. The PHI involved included names, addresses, Social Security · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 9684 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.